Executive brief
OpenClaw is a widely-used sandbox and execution environment that restricts where applications can write files via the OpenShell filesystem bridge. A timing race condition allows an attacker to swap symlinks during file write operations, causing writes intended for the sandbox's restricted mount root to be redirected outside the sandbox. This could allow an attacker to write files outside intended boundaries, potentially compromising system integrity.
Technical details
The vulnerability is a time-of-check/time-of-use (TOCTOU) race condition (CWE-367) in OpenShell's filesystem bridge write operations. The vulnerable code checks whether a file path is within the intended mount root, but an attacker can swap symlinks between the check and the actual write operation, bypassing the sandbox restriction. The attack requires the ability to perform filesystem operations on the target system and does not require elevated privileges or user interaction. An attacker exploiting this can redirect writes outside the local mount root, potentially writing arbitrary files to the filesystem. The vulnerability was fixed in version 2026.4.22 with validation of canonical targets against the mount root, rejection of unsafe symlink parents and leaves for writes, and use of root-scoped write helpers.
Affected products
- OpenClaw OpenClaw <= 2026.4.21
Timeline
- 2026-04-23: disclosed: Original advisory GHSA-wppj-c6mr-83jj published
- 2026-04-22: patched: Fixed in OpenClaw version 2026.4.22
- 2026-05-06: other: Duplicate advisory GHSA-6f72-9gxx-98mj published
- 2026-05-11: other: Duplicate advisory GHSA-6f72-9gxx-98mj withdrawn